File name:

Kriptor.exe

Full analysis: https://app.any.run/tasks/851384c8-e816-4921-a40c-61f94fdbc6dd
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: August 05, 2022, 14:04:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
hildacrypt
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

8426808EFAFE6E86395CF8B4E7926C68

SHA1:

2E27AD5332A6EFD3FB1A5399A62E1226A6C10289

SHA256:

5DA5075A6D9660FE9AA0C7B0F8608E386C9C88B230F35B770B41DBDA4C37BCC9

SSDEEP:

3072:sr85CS8+IjmETXk1DLiD0w7q4+Ehgi3M1SBJhGvlfb9FDh5ahYkq9MZO:k9S8hjLrkviYKJhq3dkq9V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • Kriptor.exe (PID: 3808)
      • Kriptor.exe (PID: 3116)
      • chrome.exe (PID: 3020)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 3540)

    • Application was dropped or rewritten from another process

      • svchost.exe (PID: 3540)
      • Kriptor.exe (PID: 3808)

    • Actions looks like stealing of personal data

      • svchost.exe (PID: 3540)

    • Writes to a start menu file

      • svchost.exe (PID: 3540)

    • Task Manager has been disabled (taskmgr)

      • svchost.exe (PID: 3540)

    • Steals credentials from Web Browsers

      • svchost.exe (PID: 3540)

    • Modifies files in Chrome extension folder

      • svchost.exe (PID: 3540)

  • SUSPICIOUS

    • Checks supported languages

      • Kriptor.exe (PID: 3116)
      • Kriptor.exe (PID: 3808)
      • svchost.exe (PID: 3540)
      • cmd.exe (PID: 2728)
      • cmd.exe (PID: 3956)
      • WMIC.exe (PID: 2416)
      • cmd.exe (PID: 3336)
      • notepad++.exe (PID: 932)
      • gup.exe (PID: 2316)

    • Reads the computer name

      • Kriptor.exe (PID: 3116)
      • Kriptor.exe (PID: 3808)
      • svchost.exe (PID: 3540)
      • WMIC.exe (PID: 2416)
      • notepad++.exe (PID: 932)
      • gup.exe (PID: 2316)

    • Drops a file with a compile date too recent

      • Kriptor.exe (PID: 3808)
      • Kriptor.exe (PID: 3116)
      • chrome.exe (PID: 3020)

    • Executable content was dropped or overwritten

      • Kriptor.exe (PID: 3116)
      • Kriptor.exe (PID: 3808)
      • chrome.exe (PID: 3020)

    • Creates executable files which already exist in Windows

      • Kriptor.exe (PID: 3808)

    • Starts itself from another location

      • Kriptor.exe (PID: 3808)

    • Executed as Windows Service

      • vssvc.exe (PID: 3012)
      • wbengine.exe (PID: 1748)
      • vds.exe (PID: 712)

    • Executed via COM

      • vdsldr.exe (PID: 2032)

    • Creates files in the program directory

      • svchost.exe (PID: 3540)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3020)

  • INFO

    • Reads the computer name

      • vssadmin.exe (PID: 2468)
      • vssvc.exe (PID: 3012)
      • WINWORD.EXE (PID: 3524)
      • wbadmin.exe (PID: 3412)
      • wbengine.exe (PID: 1748)
      • vdsldr.exe (PID: 2032)
      • vds.exe (PID: 712)
      • chrome.exe (PID: 3020)
      • chrome.exe (PID: 2716)
      • chrome.exe (PID: 2176)
      • chrome.exe (PID: 2636)
      • chrome.exe (PID: 2736)
      • chrome.exe (PID: 1236)
      • chrome.exe (PID: 3380)
      • chrome.exe (PID: 772)

    • Checks supported languages

      • vssadmin.exe (PID: 2468)
      • vssvc.exe (PID: 3012)
      • WINWORD.EXE (PID: 3524)
      • bcdedit.exe (PID: 2208)
      • bcdedit.exe (PID: 3208)
      • wbadmin.exe (PID: 3412)
      • wbengine.exe (PID: 1748)
      • vdsldr.exe (PID: 2032)
      • vds.exe (PID: 712)
      • NOTEPAD.EXE (PID: 2296)
      • chrome.exe (PID: 3020)
      • chrome.exe (PID: 2176)
      • chrome.exe (PID: 3508)
      • chrome.exe (PID: 2716)
      • chrome.exe (PID: 3372)
      • chrome.exe (PID: 2088)
      • chrome.exe (PID: 2520)
      • chrome.exe (PID: 3396)
      • chrome.exe (PID: 2636)
      • chrome.exe (PID: 2700)
      • chrome.exe (PID: 976)
      • chrome.exe (PID: 3148)
      • chrome.exe (PID: 2736)
      • chrome.exe (PID: 772)
      • chrome.exe (PID: 3352)
      • chrome.exe (PID: 2264)
      • chrome.exe (PID: 924)
      • chrome.exe (PID: 3236)
      • chrome.exe (PID: 2372)
      • chrome.exe (PID: 116)
      • chrome.exe (PID: 1068)
      • chrome.exe (PID: 3380)
      • chrome.exe (PID: 2400)
      • chrome.exe (PID: 2096)
      • chrome.exe (PID: 1236)
      • chrome.exe (PID: 772)
      • chrome.exe (PID: 2344)
      • chrome.exe (PID: 4004)
      • chrome.exe (PID: 2476)
      • chrome.exe (PID: 3216)

    • Manual execution by user

      • WINWORD.EXE (PID: 3524)
      • chrome.exe (PID: 3020)
      • notepad++.exe (PID: 932)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3524)

    • Application launched itself

      • chrome.exe (PID: 3020)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2176)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 6 (89.3)
.exe | Win32 Executable Delphi generic (4.8)
.dll | Win32 Dynamic Link Library (generic) (2.2)
.exe | Win32 Executable (generic) (1.5)
.exe | Win16/32 Executable Delphi generic (0.7)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x80e4
UninitializedDataSize: -
InitializedDataSize: 10752
CodeSize: 29696
LinkerVersion: 2.25
PEType: PE32
TimeStamp: 1992:06:20 00:22:17+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Jun-1992 22:22:17
Detected languages:
  • Russian - Russia

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 19-Jun-1992 22:22:17
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
CODE
0x00001000
0x0000722C
0x00007400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.51167
DATA
0x00009000
0x00000218
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.1517
BSS
0x0000A000
0x0000A899
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00015000
0x00000864
0x00000A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.17386
.tls
0x00016000
0x00000008
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rdata
0x00017000
0x00000018
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
0.20692
.reloc
0x00018000
0x000005CC
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
6.44309
.rsrc
0x00019000
0x00001400
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
5.27048

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.84308
4264
UNKNOWN
Russian - Russia
RT_ICON
DVCLAL
4
16
UNKNOWN
UNKNOWN
RT_RCDATA
PACKAGEINFO
6.90278
172
UNKNOWN
UNKNOWN
RT_RCDATA
MAINICON
1.7815
20
UNKNOWN
Russian - Russia
RT_GROUP_ICON

Imports

advapi32.dll
gdi32.dll
kernel32.dll
oleaut32.dll
shell32.dll
user32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
95
Monitored processes
49
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start kriptor.exe kriptor.exe svchost.exe cmd.exe no specs vssadmin.exe no specs vssvc.exe no specs winword.exe no specs wmic.exe no specs cmd.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs wbadmin.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs notepad.exe no specs chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs notepad++.exe gup.exe chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,1251313864040617610,1918240265373945149,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\chrome.exe
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\gdi32.dll
712C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
772"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1048,1251313864040617610,1918240265373945149,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3252 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\gdi32.dll
772"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1048,1251313864040617610,1918240265373945149,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2120 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
924"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,1251313864040617610,1918240265373945149,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2888 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
932"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\rootagency.rtf.Kriptor"C:\Program Files\Notepad++\notepad++.exe
Explorer.EXE
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\notepad++\notepad++.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
976"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1048,1251313864040617610,1918240265373945149,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,1251313864040617610,1918240265373945149,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1236"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1048,1251313864040617610,1918240265373945149,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1720 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
1748"C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Block Level Backup Engine Service EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbengine.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
19 035
Read events
18 169
Write events
718
Delete events
148

Modification events

(PID) Process:(3116) Kriptor.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3116) Kriptor.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3116) Kriptor.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3116) Kriptor.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3808) Kriptor.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3808) Kriptor.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3808) Kriptor.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3808) Kriptor.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3540) svchost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:UpdateTask
Value:
C:\Users\admin\AppData\Roaming\svchost.exe
(PID) Process:(3540) svchost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
28
Suspicious files
825
Text files
618
Unknown types
17

Dropped files

PID
Process
Filename
Type
3808Kriptor.exeC:\Users\admin\AppData\Roaming\svchost.exeexecutable
MD5:8F36A2AEAEA13F28D68827F2D0F2432B
SHA256:B7547B2C43006A3D9970564540C683CA8286DB0F8E736BBB9E1A365E60456B3E
3116Kriptor.exeC:\Users\admin\AppData\Local\Temp\3582-490\Kriptor.exeexecutable
MD5:8F36A2AEAEA13F28D68827F2D0F2432B
SHA256:B7547B2C43006A3D9970564540C683CA8286DB0F8E736BBB9E1A365E60456B3E
3116Kriptor.exeC:\MSOCache\All Users\{90140000-006E-0407-0000-0000000FF1CE}-C\DW20.EXEexecutable
MD5:02EE6A3424782531461FB2F10713D3C1
SHA256:EAD58C483CB20BCD57464F8A4929079539D634F469B213054BF737D227C026DC
3524WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR593F.tmp.cvr —
MD5:—
SHA256:—
3116Kriptor.exeC:\MSOCache\All Users\{90140000-006E-040C-0000-0000000FF1CE}-C\dwtrig20.exeexecutable
MD5:CF6C595D3E5E9667667AF096762FD9C4
SHA256:593E60CC30AE0789448547195AF77F550387F6648D45847EA244DD0DD7ABF03D
3116Kriptor.exeC:\MSOCache\All Users\{90140000-006E-040C-0000-0000000FF1CE}-C\DW20.EXEexecutable
MD5:02EE6A3424782531461FB2F10713D3C1
SHA256:EAD58C483CB20BCD57464F8A4929079539D634F469B213054BF737D227C026DC
3116Kriptor.exeC:\MSOCache\All Users\{90140000-0100-040C-0000-0000000FF1CE}-C\setup.exeexecutable
MD5:566ED4F62FDC96F175AFEDD811FA0370
SHA256:E17CD94C08FC0E001A49F43A0801CEA4625FB9AEE211B6DFEBEBEC446C21F460
3116Kriptor.exeC:\MSOCache\All Users\{90140000-0100-0419-0000-0000000FF1CE}-C\setup.exeexecutable
MD5:566ED4F62FDC96F175AFEDD811FA0370
SHA256:E17CD94C08FC0E001A49F43A0801CEA4625FB9AEE211B6DFEBEBEC446C21F460
3116Kriptor.exeC:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\setup.exeexecutable
MD5:566ED4F62FDC96F175AFEDD811FA0370
SHA256:E17CD94C08FC0E001A49F43A0801CEA4625FB9AEE211B6DFEBEBEC446C21F460
3116Kriptor.exeC:\MSOCache\All Users\{90140000-006E-0416-0000-0000000FF1CE}-C\DW20.EXEexecutable
MD5:02EE6A3424782531461FB2F10713D3C1
SHA256:EAD58C483CB20BCD57464F8A4929079539D634F469B213054BF737D227C026DC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
54
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2176
chrome.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
crx
242 Kb
whitelisted
2176
chrome.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?85e4b8c370a96a70
US
compressed
60.2 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2176
chrome.exe
142.250.184.196:443
www.google.com
Google Inc.
US
whitelisted
2176
chrome.exe
142.250.185.141:443
accounts.google.com
Google Inc.
US
whitelisted
2176
chrome.exe
142.250.185.78:443
clients2.google.com
Google Inc.
US
whitelisted
2176
chrome.exe
142.250.186.161:443
clients2.googleusercontent.com
Google Inc.
US
whitelisted
2176
chrome.exe
142.250.185.227:443
www.gstatic.com
Google Inc.
US
whitelisted
2176
chrome.exe
142.251.36.42:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2176
chrome.exe
142.250.185.131:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2176
chrome.exe
172.217.16.142:443
apis.google.com
Google Inc.
US
whitelisted
2176
chrome.exe
142.250.74.195:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2176
chrome.exe
142.250.185.67:443
update.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google.com
  • 142.250.184.196
malicious
clients2.google.com
  • 142.250.185.78
whitelisted
accounts.google.com
  • 142.250.185.141
shared
clients2.googleusercontent.com
  • 142.250.186.161
whitelisted
fonts.googleapis.com
  • 142.251.36.42
whitelisted
www.gstatic.com
  • 142.250.185.227
whitelisted
fonts.gstatic.com
  • 142.250.185.131
  • 142.250.186.35
whitelisted
apis.google.com
  • 172.217.16.142
whitelisted
clientservices.googleapis.com
  • 142.250.74.195
whitelisted
update.googleapis.com
  • 142.250.185.67
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Kriptor.exe